ToToTEK.COM

[rodneyk]

Hi Mystic_Merlin,

I'm glad to be of help, only sorry that the conclusion is negative for your copier.

If you understand the basics of what the copier does it goes a long way in understanding how to rebuild it. I'm not doing a RE based on a copier with several seperate programmable chips but I am going to try to use the earlier model on which many other copiers are based. The supercom only has one unknown component, the EP1810 programmable chip. Perhaps it's a bit more difficult that way but I want to start at the beginning and then work my way further to more advanced copiers.

If I were to use for example a pro fighter Q as a starting point, which is a good candidate because it is very stable and has several smaller programmable chips, I would take a structured approach which is based on the surrounding components of each programmable chip, from which it's function can be derived, just like kyuusaku mentioned. It's a matter of drawing the schematics to get the overall larger structure documented and then choosing a target chip to analyze under different operating conditions of the copier. I do have a pro fighter Q and do plan to RE it later. The advantage of multiple chips is that internal signals which connect the chips of different functions will be available to analyze, contrary to one big chip which has the internal signals inside and not available to sample.

However I hope that despite this I can succeed with the supercom just from observing the chip's signals and theorising what's inside.

What kyuusaku mentioned is exacly what I found too. Those floppy disk controller chips, many of them function based on a common standard. I got the first indication during my research when I finally found the datasheet of the motorola MCCS3201FN controller which is found in many copiers. What motorola mentioned is that the chip is compatible with PC standard. So actually you can use the MCCS3201FN in a PC.

What I think they did in the supercom for example, without any verification at this time, if anyone knows otherwise let them say so, is to hardwire most of the FDC chip's address lines to the FDC PC standard I/O address to trigger the FDC's internal address decoder to enable the chip, and only leave the last three address bits connected to the SNES. That way they could invent their own I/O address range (C000-C007) and let the last three bits determine which floppy control register is opened at their own custom address range. The FDC simply responds to standard commands known from PC standards to operate the floppy drive. That is why it can be exchanged with another brand/type. As far as I can see is that the SNES does a memory mapped I/O when accessing the FDC. That means that the FDC is mapped into normal memory space. It seems that the FDC does not operate in DMA mode but in a more 'direct' mode.

There are two main difficult points in REing the supercom that I see so far:

- DRAM control (timing/refresh)
The DRAM control might be complex, or it might be more simple, I don't know yet because I am not looking at that yet. Normally speaking the DRAM control operates like kyuusaku mentioned on a "state machine" principle which means that the control of DRAM goes through different state points or steps in a timing scheme in order to structurally perform different tasks at the right times to the memory chips which alternates between memory operations, address selection and refreshing the DRAM memories so they retain the data. That is a basic feature of DRAM that it needs to be "refreshed" at regular critical intervals or otherwise the memory cells will lose their data. Actually I am hoping the engineers found an easy way to alternate between memory access and refresh. One indication in favour of this seems to be that the EP1810 programmable chip is not connected to a clock pulse, at least I so far didn't see any indication that it receives a clock from somewhere.

- system mode control
The copier is operating in different system modes, for example, it behaves differently while running a game from RAM and also differently when operating it's built in menus and for example reading a game into memory from floppy drive. The copier internally switches the system mode which enables and disables the copier ROM, FDC and parallel interface. There should be some mode select register inside which stores and controls the current system mode. I saw some indication in that text file I mentioned that the mode select register is possibly mapped to addresses E004-E007. They use some strange notation of addresses that I haven't yet fully figured out. I did some analyzing so far but there is still a lot unknown.

Most of the supercom can be easily rebuilt. I am planning to rebuild the contents of the programmable chip, which is the only unknown thing, with loose standard logic chips. I am just going to try to prove the operation first. I like the transparancy that normal logic chips provide. Using small SMD versions in a final prototype will help to reduce PCB size. There are many approaches possible but I like this one more, to me, that's more fun and more tangable to do it that way.

[Mystic_Merlin]

Always nice to read your writings, though I'll need to go over it a couple of times

I pretty much understood that the "exploded" design of a Pro Fighter into several custom logic chips rather than a single FPGA makes the RE easier; a little bit the difference between a microcontroller and a microprocessor communicating with external bus addresses and data lines...

To come back to your DRAM control part, I wonder if has anything to do with the problem I met here:
http://tototek.com/phpBB2/viewtopic.php?p=11245#11245
The SPFX, although having the same exact PCB as the previous Pro Fighters but the same BIOS as later PFX, the RAM is not compatible. I believe something has been changed in the custom logic chips of this hybrid model.
Also why is there 10 more pins on later RAM designs? Apart from addressing more memory, is there a complete new way to handle memory?

[CrackLtd]

Dudes, may i suggest a shortcut!? Go buy a SWC DX2, end of story. Invest your knowledge and time in doing a NeoGeo Flashcart. You problem, me solution. Pleasure!

[rodneyk]

Hi Mystic_Merlin,

Sorry for a late answer, I have been very busy with work the past weeks.

I agree that the 'exploded' version of copiers with more chips makes reverse engineering more easy, that is certainly true. I will also study my Super Profighter Q to gain more knowledge of the EP1810 in the supercom. Since they are related I am sure it will give more important clues.

The difference in RAM boards probably lies in increased capacity which needs some more address line pins, or a different method of accessing the newer larger memory chips with more pins. I haven't studied this in detail yet at the moment. With a super wild card DX2 I am sure the increased memory capacity is the reason for more pins.

Even though the BIOS is the same in copiers, the custom chips might differ between them. They amongst other functions control the memory which explains the necessary difference in RAM board types. The different custom chips might be designed differently to allow expansion to greater maximum memory capacity. That would make sense as a reason to change the custom chip and the memory control pins between the board and the copier. Since the custom chip automatically handles memory access, it is quite possible that the BIOS doesn't need to be changed in some cases where the custom chip is different.

I would advise to carefully look at the structure/ trace layout of the original RAM PCB which came with a copier. That gives a good clue on what might and what might not work on the copier. When the layout of another board is very different and doesn't seem similar, it's likely that the board will not work. Mostly you can look at the basic layout in comparison between two memory boards to guess if the memory board with larger memory will work with that copier.

For example, some RAM boards use chips with more pins than others, and these RAM boards might have fewer chips on them as well. The memory control is fundamentally different with those boards which can carry 8 chips like typically found on the earlier profighters and the supercom.